New Snowblind Android trojan examined

Intrusions with Snowblind involved the injection of a seccomp filter to intercept system calls, as well as a SIGSYS signal handler to direct anti-tampering code to unchanged APK versions allowing the deactivation of several app security features.

Article Link: New Snowblind Android trojan examined | SC Media

1 post - 1 participant

Read full topic

android android trojan apk app article code deactivation features filter injection intercept link media seccomp security security features signal snowblind system tampering topic trojan